dhi.io/aspnetcore
ASP.NET Core 8.x (fips, dev)
8-debian-fips-dev, 8-debian13-fips-dev, 8-fips-dev, 8.0-debian-fips-dev, 8.0-debian13-fips-dev, 8.0-fips-dev, 8.0.34-debian-fips-dev, 8.0.34-debian13-fips-dev, 8.0.34-fips-dev
sha256:42e9877f6ede35e8b7292348a5245cec23c8511cedb34889816fd3149dd08fee
Manifest digest:sha256:085b0b9325913cea493a9bbaff63be146901e23e557f37ee075defbcb58f5fc1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/aspnetcore:8-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/aspnetcore:8-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/aspnetcore@sha256:bcbf6cc2c16812ba491be1838463d227204921670c995876d50981de3d04b01c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/aspnetcore@sha256:77e4a30f3439408461d5b9d33f3a66fcb7c9ed920e290d435527990f122a4129 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/aspnetcore@sha256:22048fc403c5a4622512e79f02b69de02b2139bb18aeca81b8b09309ef9a89e5 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/aspnetcore@sha256:56971220171060e56722b1894a1229dfff1e19bfe4aaf6d995f01ab291cece79 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/aspnetcore@sha256:d2b710ed3464e4dca53998c2696906cc4d4930e4e7f46f939bc8ad24d8ddb8a8 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/aspnetcore@sha256:cad7eac87c15b5e0bd560e91b3ef44b9baebe69554324dca6c58600d72719991 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/aspnetcore@sha256:d07ed52610da54c6009db84b25fc24d6ff14700b43ac79d8d8fb0e4cd317b6f0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/aspnetcore@sha256:fc2ce118fa043fdc97e613ca9309fd485a98ca998c6930e71b937988a8c9636c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/aspnetcore@sha256:0b71b835ec36cbd74b10002b5313aeb0c77bfbbc14390d648b52e65ea24a9299 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/aspnetcore@sha256:a83312396afb2aee01dd9a8044868e03a55f0df42036ba61ea5d6df5c50991a4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/aspnetcore@sha256:48401e2a0a18dd60bbe8917a68e81991b2c50733a5c5446a91767993cd60f960 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/aspnetcore@sha256:14e2a17e96f46eff75d7607de383af55bd2a6eb742e93ca50b6d8684bacf0afc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/aspnetcore@sha256:ab96d2fc182d579894e12378ffc18022bd8efbbf419edfa2eac99411f299206e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/aspnetcore@sha256:cfa8c3493302da440583c91318972fcda93a74efc2f47d4510baa5d743f5ed5b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/aspnetcore@sha256:7284b28d475972cfd8b896f4a64b91b6b53ae0e0e7e4ae20bac454c4722dbd9f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/aspnetcore@sha256:08801b7bb8e174b7cbb1927c044e7a19a9f2eaf35b121709dfc21a068058f66a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/aspnetcore@sha256:50401652960803a2fa232b65b450aa9a7b7dd9f5fac8b99393c706f098a5f894 |